What application, service or process started another app, serv or pro?

[MattStan]

Hi,

The latest anti. ad software has not got rid of all the ad software on my
machine. Periodically an IE window pops up unsolicited with an advert, this
happens when IE is not open (I use Netscape 95% of the time) so I know it
is not just a pop-up window started by a web site I've visiting. Some nasty
software is on my machine and starting IE with adverts. Is there any way I
can find what application, service or process started a particular instance
of IE? --When writing Windows software I remember windows have 'owners',
knowing the owner will allow me to trace the software that starts the ads
and remove it.

The MS Info 32 (msinfo32.exe) program gives more info. than 'task manager'
such as the path, start time, priority, etc. of a running task, but even in
'advanced mode' it does not show ownership.

Thanks,

..matthew

[Lanwench [MVP - Exchange]]

Does the window title say anything about Messenger? If so, you need a
firewall. 'Messenger spam', is not in itself harmful, but is symptomatic of
a larger problem - your computer has ports open from the Internet.

You can disable the Messenger service, but that is unwise as a solution as
you'll still have the underlying problem that caused you to get the messages
in the first place - consider the messages a useful warning that you have no
protection from the Internet. This is all too important now, given the
recent rash of RPC worms....

For a standalone machine, see www.sygate.com for a free personal firewall,
or if using Windows XP, you can enable the built-in internet connection
firewall (ICF).

See http://securityadmin.info/faq.htm for more info. Also,
http://www.mvps.org/winhelp2002/nopopups.htm is a good resource - although
for browser popups, you might want to consider http://toolbar.google.com -
it works like a champ and is also handy for searching.

[MattStan]

Thanks for your reply.

Actually I do use a firewall, but now think it's not a very good one. I
tried some more anti-adware software and that got some that the other
software had missed. I think there may be more though.

On advice I found on the web, I have stopped and disabled the Messenger
service before reading your post. Why do you say this is unwise as a
solution? I agree stopping it won't end my current problems but in
conjunction it may help. Does Messenger do anything that I may find useful
and regret disabling it?

I shall try the sygate firewall, thanks for the suggestion.

Thanks and regards,

..matthew

[Lanwench [MVP - Exchange]]

Re the messenger service - if you aren't on a network, you may not care very
much about using it. All I mean is that disabling it is not the answer to
the 'messenger spam' problem.....

[MattStan]

Lanwench [MVP - Exchange] wrote:
> Re the messenger service - if you aren't on a network, you may not care very
> much about using it. All I mean is that disabling it is not the answer to
> the 'messenger spam' problem.....

Thanks for the clarification. I do have my 2 PCs (Win2000 and Linux)
networked but only because linux runs my MySQL database and I use samba for
file sharing (mainly as an extra 'local' backup solution).

Thanks so much for suggesting sygate, it's great. I uninstalled blackice
and installed sygate - almost immediately I discovered how bad BlackIce had
been - a virus on my system was making outgoing connections somehow missed
by Norton when I'd recently run anti-virus. On investigation I discovered
blackice was monitoring incoming connections only (I don't know if the
latest versions of blackice firewall monitors outgoing connections but the
version I bought has no facility for monitoring outgoing connections at all
- I obviously did bad research when deciding which fiewall to buy).

Having now run 3 different anti-adware programs, 2 full system virus scans
with different software and monitored sygate's firewall closely I now
believe my machine is clean. Phewww.

Thanks,

..matthew